sraverify 0.1.0__py3-none-any.whl

sraverify/services/shield/checks/sra_shield_06.py

@@ -0,0 +1,84 @@
+"""
+Check if Shield Advanced is configured for Route 53 hosted zones.
+"""
+from typing import Dict, List, Any
+from sraverify.services.shield.base import ShieldCheck
+
+
+class SRA_SHIELD_06(ShieldCheck):
+    """Check if Shield Advanced is configured for Route 53 hosted zones."""
+
+    def __init__(self):
+        """Initialize Shield Advanced Route 53 protection check."""
+        super().__init__()
+        self.check_id = "SRA-SHIELD-06"
+        self.check_name = "Shield Advanced is configured for Route 53 hosted zones"
+        self.description = ("This check verifies that AWS Shield Advanced is protecting "
+                            "at least one Route 53 hosted zone.")
+        self.severity = "HIGH"
+        self.check_logic = ("List Shield protections and filter by Route 53 ARNs. "
+                            "Check fails if no Route 53 hosted zones are protected.")
+
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+
+        Returns:
+            List of findings
+        """
+        # Shield is a global service, check only in us-east-1
+        region = "us-east-1"
+        protections = self.list_protections(region)
+
+        if "Error" in protections:
+            error_code = protections["Error"].get("Code", "")
+            if error_code == "ResourceNotFoundException":
+                self.findings.append(self.create_finding(
+                    status="FAIL",
+                    region=region,
+                    resource_id=None,
+                    actual_value="Shield Advanced subscription not found",
+                    remediation="Enable Shield Advanced subscription to protect resources"
+                ))
+            else:
+                self.findings.append(self.create_finding(
+                    status="ERROR",
+                    region=region,
+                    resource_id=None,
+                    actual_value=protections["Error"].get("Message", "Unknown error"),
+                    remediation="Check IAM permissions for Shield API access"
+                ))
+        elif protections.get("Protections"):
+            # Filter for Route 53 hosted zones by checking ResourceArn
+            route53_protections = [
+                p for p in protections["Protections"]
+                if "route53" in p.get("ResourceArn", "").lower() and "hostedzone" in p.get("ResourceArn", "").lower()
+            ]
+
+            if route53_protections:
+                protected_count = len(route53_protections)
+                self.findings.append(self.create_finding(
+                    status="PASS",
+                    region=region,
+                    resource_id="shield:route53-protections",
+                    actual_value=f"{protected_count} Route 53 hosted zone(s) protected",
+                    remediation=""
+                ))
+            else:
+                self.findings.append(self.create_finding(
+                    status="FAIL",
+                    region=region,
+                    resource_id=None,
+                    actual_value="No Route 53 hosted zones protected",
+                    remediation="Enable Shield Advanced protection for Route 53 hosted zones in the AWS Shield console"
+                ))
+        else:
+            self.findings.append(self.create_finding(
+                status="FAIL",
+                region=region,
+                resource_id=None,
+                actual_value="No Route 53 hosted zones protected",
+                remediation="Enable Shield Advanced protection for Route 53 hosted zones in the AWS Shield console"
+            ))
+
+        return self.findings

sraverify/services/shield/checks/sra_shield_07.py

@@ -0,0 +1,84 @@
+"""
+Check if Shield Advanced is configured for Global Accelerator.
+"""
+from typing import Dict, List, Any
+from sraverify.services.shield.base import ShieldCheck
+
+
+class SRA_SHIELD_07(ShieldCheck):
+    """Check if Shield Advanced is configured for Global Accelerator."""
+
+    def __init__(self):
+        """Initialize Shield Advanced Global Accelerator protection check."""
+        super().__init__()
+        self.check_id = "SRA-SHIELD-07"
+        self.check_name = "Shield Advanced is configured for Global Accelerator"
+        self.description = ("This check verifies that AWS Shield Advanced is protecting "
+                            "at least one Global Accelerator accelerator.")
+        self.severity = "HIGH"
+        self.check_logic = ("List Shield protections and filter by Global Accelerator ARNs. "
+                            "Check fails if no Global Accelerator accelerators are protected.")
+
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+
+        Returns:
+            List of findings
+        """
+        # Shield is a global service, check only in us-east-1
+        region = "us-east-1"
+        protections = self.list_protections(region)
+
+        if "Error" in protections:
+            error_code = protections["Error"].get("Code", "")
+            if error_code == "ResourceNotFoundException":
+                self.findings.append(self.create_finding(
+                    status="FAIL",
+                    region=region,
+                    resource_id=None,
+                    actual_value="Shield Advanced subscription not found",
+                    remediation="Enable Shield Advanced subscription to protect resources"
+                ))
+            else:
+                self.findings.append(self.create_finding(
+                    status="ERROR",
+                    region=region,
+                    resource_id=None,
+                    actual_value=protections["Error"].get("Message", "Unknown error"),
+                    remediation="Check IAM permissions for Shield API access"
+                ))
+        elif protections.get("Protections"):
+            # Filter for Global Accelerator by checking ResourceArn
+            ga_protections = [
+                p for p in protections["Protections"]
+                if "globalaccelerator" in p.get("ResourceArn", "").lower()
+            ]
+
+            if ga_protections:
+                protected_count = len(ga_protections)
+                self.findings.append(self.create_finding(
+                    status="PASS",
+                    region=region,
+                    resource_id="shield:globalaccelerator-protections",
+                    actual_value=f"{protected_count} Global Accelerator accelerator(s) protected",
+                    remediation=""
+                ))
+            else:
+                self.findings.append(self.create_finding(
+                    status="FAIL",
+                    region=region,
+                    resource_id=None,
+                    actual_value="No Global Accelerator accelerators protected",
+                    remediation="Enable Shield Advanced protection for Global Accelerator accelerators in the AWS Shield console"
+                ))
+        else:
+            self.findings.append(self.create_finding(
+                status="FAIL",
+                region=region,
+                resource_id=None,
+                actual_value="No Global Accelerator accelerators protected",
+                remediation="Enable Shield Advanced protection for Global Accelerator accelerators in the AWS Shield console"
+            ))
+
+        return self.findings

sraverify/services/shield/checks/sra_shield_08.py

@@ -0,0 +1,69 @@
+"""
+Check if Shield Response Team (SRT) access is configured.
+"""
+from typing import Dict, List, Any
+from sraverify.services.shield.base import ShieldCheck
+
+
+class SRA_SHIELD_08(ShieldCheck):
+    """Check if Shield Response Team (SRT) access is configured."""
+
+    def __init__(self):
+        """Initialize Shield Response Team access check."""
+        super().__init__()
+        self.check_id = "SRA-SHIELD-08"
+        self.check_name = "Shield Response Team (SRT) access is configured"
+        self.description = ("This check verifies that AWS Shield Response Team (SRT) "
+                            "access is configured with an appropriate IAM role.")
+        self.severity = "MEDIUM"
+        self.check_logic = "Describe DRT access configuration. Check fails if no role ARN is configured."
+
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+
+        Returns:
+            List of findings
+        """
+        # Shield is a global service, check only in us-east-1
+        region = "us-east-1"
+        drt_access = self.describe_drt_access(region)
+
+        if "Error" in drt_access:
+            error_code = drt_access["Error"].get("Code", "")
+            if error_code == "ResourceNotFoundException":
+                self.findings.append(self.create_finding(
+                    status="FAIL",
+                    region=region,
+                    resource_id=None,
+                    actual_value="SRT access not configured",
+                    remediation="Configure Shield Response Team access by associating an IAM role using AssociateDRTRole API"
+                ))
+            else:
+                self.findings.append(self.create_finding(
+                    status="ERROR",
+                    region=region,
+                    resource_id=None,
+                    actual_value=drt_access["Error"].get("Message", "Unknown error"),
+                    remediation="Check IAM permissions for Shield API access"
+                ))
+        elif drt_access.get("RoleArn"):
+            role_arn = drt_access["RoleArn"]
+            bucket_count = len(drt_access.get("LogBucketList", []))
+            self.findings.append(self.create_finding(
+                status="PASS",
+                region=region,
+                resource_id="shield:srt-access",
+                actual_value=f"SRT access configured with role: {role_arn}, {bucket_count} log bucket(s)",
+                remediation=""
+            ))
+        else:
+            self.findings.append(self.create_finding(
+                status="FAIL",
+                region=region,
+                resource_id=None,
+                actual_value="SRT access not configured",
+                remediation="Configure Shield Response Team access by associating an IAM role using AssociateDRTRole API"
+            ))
+
+        return self.findings

sraverify/services/shield/checks/sra_shield_09.py

@@ -0,0 +1,86 @@
+"""
+Check if Shield Advanced proactive engagement is enabled.
+"""
+from typing import Dict, List, Any
+from sraverify.services.shield.base import ShieldCheck
+
+
+class SRA_SHIELD_09(ShieldCheck):
+    """Check if Shield Advanced proactive engagement is enabled."""
+
+    def __init__(self):
+        """Initialize Shield Advanced proactive engagement check."""
+        super().__init__()
+        self.check_id = "SRA-SHIELD-09"
+        self.check_name = "Shield Advanced proactive engagement is enabled"
+        self.description = ("This check verifies that AWS Shield Advanced proactive engagement "
+                            "is enabled, allowing the Shield Response Team to contact you directly during attacks.")
+        self.severity = "MEDIUM"
+        self.check_logic = ("Get Shield subscription details and check ProactiveEngagementStatus. "
+                            "Check fails if proactive engagement is disabled.")
+
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+
+        Returns:
+            List of findings
+        """
+        # Shield is a global service, check only in us-east-1
+        region = "us-east-1"
+        subscription = self.get_subscription_state(region)
+
+        if "Error" in subscription:
+            error_code = subscription["Error"].get("Code", "")
+            if error_code == "ResourceNotFoundException":
+                self.findings.append(self.create_finding(
+                    status="FAIL",
+                    region=region,
+                    resource_id=None,
+                    actual_value="Shield Advanced not subscribed",
+                    remediation="Enable Shield Advanced subscription in the AWS Shield console"
+                ))
+            else:
+                self.findings.append(self.create_finding(
+                    status="ERROR",
+                    region=region,
+                    resource_id=None,
+                    actual_value=subscription["Error"].get("Message", "Unknown error"),
+                    remediation="Check IAM permissions for Shield API access"
+                ))
+        elif "Subscription" in subscription:
+            proactive_status = subscription["Subscription"].get("ProactiveEngagementStatus", "")
+            if proactive_status == "ENABLED":
+                self.findings.append(self.create_finding(
+                    status="PASS",
+                    region=region,
+                    resource_id="shield:proactive-engagement",
+                    actual_value="Proactive engagement is enabled",
+                    remediation=""
+                ))
+            elif proactive_status == "PENDING":
+                self.findings.append(self.create_finding(
+                    status="FAIL",
+                    region=region,
+                    resource_id="shield:proactive-engagement",
+                    actual_value="Proactive engagement is pending",
+                    remediation="Complete proactive engagement setup by providing emergency contacts"
+                ))
+            else:
+                self.findings.append(self.create_finding(
+                    status="FAIL",
+                    region=region,
+                    resource_id="shield:proactive-engagement",
+                    actual_value=f"Proactive engagement is {proactive_status or 'disabled'}",
+                    remediation="Enable proactive engagement using EnableProactiveEngagement API and configure emergency contacts"
+                ))
+        else:
+            self.findings.append(self.create_finding(
+                status="FAIL",
+                region=region,
+                resource_id=None,
+                actual_value="Shield Advanced subscription not found",
+                remediation="Enable Shield Advanced subscription in the AWS Shield console"
+            ))
+
+        return self.findings

sraverify/services/shield/checks/sra_shield_10.py

@@ -0,0 +1,100 @@
+"""
+Check if health checks are configured for Shield Advanced protected resources.
+"""
+from typing import Dict, List, Any
+from sraverify.services.shield.base import ShieldCheck
+
+
+class SRA_SHIELD_10(ShieldCheck):
+    """Check if health checks are configured for Shield Advanced protected resources."""
+
+    def __init__(self):
+        """Initialize Shield Advanced health checks check."""
+        super().__init__()
+        self.check_id = "SRA-SHIELD-10"
+        self.check_name = "Health checks are configured for Shield Advanced protected resources"
+        self.description = ("This check verifies that Route 53 health checks are associated "
+                            "with Shield Advanced protected resources to enable health-based detection. "
+                            "Route 53 hosted zones are excluded as they don't support health-based detection.")
+        self.severity = "MEDIUM"
+        self.check_logic = ("List Shield protections and check HealthCheckIds field. "
+                            "Check fails if protected resources (excluding Route 53 hosted zones) lack health checks.")
+
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+
+        Returns:
+            List of findings
+        """
+        # Shield is a global service, check only in us-east-1
+        region = "us-east-1"
+        protections = self.list_protections(region)
+
+        if "Error" in protections:
+            error_code = protections["Error"].get("Code", "")
+            if error_code == "ResourceNotFoundException":
+                self.findings.append(self.create_finding(
+                    status="FAIL",
+                    region=region,
+                    resource_id=None,
+                    actual_value="Shield Advanced subscription not found",
+                    remediation="Enable Shield Advanced subscription to protect resources"
+                ))
+            else:
+                self.findings.append(self.create_finding(
+                    status="ERROR",
+                    region=region,
+                    resource_id=None,
+                    actual_value=protections["Error"].get("Message", "Unknown error"),
+                    remediation="Check IAM permissions for Shield API access"
+                ))
+        elif protections.get("Protections"):
+            # Filter out Route 53 hosted zones as they don't support health-based detection
+            eligible_protections = [
+                p for p in protections["Protections"]
+                if not ("route53" in p.get("ResourceArn", "").lower() and "hostedzone" in p.get("ResourceArn", "").lower())
+            ]
+
+            if not eligible_protections:
+                self.findings.append(self.create_finding(
+                    status="PASS",
+                    region=region,
+                    resource_id="shield:health-checks",
+                    actual_value="No resources requiring health checks found (only Route 53 hosted zones protected)",
+                    remediation=""
+                ))
+                return self.findings
+
+            # Create a finding for each eligible protected resource
+            for protection in eligible_protections:
+                resource_arn = protection.get("ResourceArn", "")
+                protection_name = protection.get("Name", "Unknown")
+                health_check_ids = protection.get("HealthCheckIds", [])
+
+                if health_check_ids:
+                    self.findings.append(self.create_finding(
+                        status="PASS",
+                        region=region,
+                        resource_id=resource_arn,
+                        actual_value=f"Health check configured: {len(health_check_ids)} health check(s)",
+                        remediation=""
+                    ))
+                else:
+                    self.findings.append(self.create_finding(
+                        status="FAIL",
+                        region=region,
+                        resource_id=resource_arn,
+                        actual_value="No health check configured",
+                        remediation="Associate a Route 53 health check with this Shield Advanced protected resource"
+                    ))
+        else:
+            self.findings.append(self.create_finding(
+                status="FAIL",
+                region=region,
+                resource_id=None,
+                actual_value="No Shield Advanced protections found",
+                remediation="Enable Shield Advanced protection for resources and configure health checks"
+            ))
+
+        return self.findings

sraverify/services/shield/checks/sra_shield_11.py

@@ -0,0 +1,71 @@
+"""
+Check if Shield engagement Lambda function is configured.
+"""
+from typing import Dict, List, Any
+from sraverify.services.shield.base import ShieldCheck
+
+
+class SRA_SHIELD_11(ShieldCheck):
+    """Check if Shield engagement Lambda function is configured."""
+
+    def __init__(self):
+        """Initialize Shield engagement Lambda function check."""
+        super().__init__()
+        self.check_id = "SRA-SHIELD-11"
+        self.check_name = "Shield engagement Lambda function is configured"
+        self.description = ("This check verifies that a Lambda function named "
+                            "'AWS_Shield_Engagement_Lambda' exists to automate support case creation during DDoS events.")
+        self.severity = "MEDIUM"
+        self.check_logic = "Check for existence of Lambda function named 'AWS_Shield_Engagement_Lambda' in us-east-1."
+
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+
+        Returns:
+            List of findings
+        """
+        # Check for Lambda function in us-east-1
+        region = "us-east-1"
+        function_name = "AWS_Shield_Engagement_Lambda"
+
+        lambda_function = self.get_lambda_function(region, function_name)
+
+        if "Error" in lambda_function:
+            error_code = lambda_function["Error"].get("Code", "")
+            if error_code == "ResourceNotFoundException":
+                self.findings.append(self.create_finding(
+                    status="FAIL",
+                    region=region,
+                    resource_id=None,
+                    actual_value="Shield engagement Lambda function not found",
+                    remediation=f"Create Lambda function named '{function_name}' to automate support case creation during DDoS events"
+                ))
+            else:
+                self.findings.append(self.create_finding(
+                    status="ERROR",
+                    region=region,
+                    resource_id=None,
+                    actual_value=lambda_function["Error"].get("Message", "Unknown error"),
+                    remediation="Check IAM permissions for Lambda API access"
+                ))
+        elif lambda_function.get("Configuration"):
+            function_arn = lambda_function["Configuration"].get("FunctionArn", "")
+            runtime = lambda_function["Configuration"].get("Runtime", "")
+            self.findings.append(self.create_finding(
+                status="PASS",
+                region=region,
+                resource_id=function_arn,
+                actual_value=f"Shield engagement Lambda function exists (Runtime: {runtime})",
+                remediation=""
+            ))
+        else:
+            self.findings.append(self.create_finding(
+                status="FAIL",
+                region=region,
+                resource_id=None,
+                actual_value="Shield engagement Lambda function not found",
+                remediation=f"Create Lambda function named '{function_name}' to automate support case creation during DDoS events"
+            ))
+
+        return self.findings

sraverify/services/shield/checks/sra_shield_12.py

@@ -0,0 +1,130 @@
+"""
+Check if Shield Advanced protected resources have WAF web ACLs associated.
+"""
+from typing import Dict, List, Any
+from sraverify.services.shield.base import ShieldCheck
+
+
+class SRA_SHIELD_12(ShieldCheck):
+    """Check if Shield Advanced protected resources have WAF web ACLs associated."""
+
+    def __init__(self):
+        """Initialize Shield Advanced WAF association check."""
+        super().__init__()
+        self.check_id = "SRA-SHIELD-12"
+        self.check_name = "Shield Advanced protected resources have WAF web ACLs associated"
+        self.description = ("This check verifies that Shield Advanced protected resources "
+                            "that support WAF (CloudFront distributions and Application Load Balancers) "
+                            "have web ACLs associated for enhanced application layer protection.")
+        self.severity = "HIGH"
+        self.check_logic = ("List Shield protections and check WAF web ACL associations "
+                            "for CloudFront distributions and Application Load Balancers.")
+
+    def execute(self) -> List[Dict[str, Any]]:
+        """
+        Execute the check.
+
+        Returns:
+            List of findings
+        """
+        # Shield is a global service, check only in us-east-1
+        region = "us-east-1"
+        protections = self.list_protections(region)
+
+        if "Error" in protections:
+            error_code = protections["Error"].get("Code", "")
+            if error_code == "ResourceNotFoundException":
+                self.findings.append(self.create_finding(
+                    status="FAIL",
+                    region=region,
+                    resource_id=None,
+                    actual_value="Shield Advanced subscription not found",
+                    remediation="Enable Shield Advanced subscription to protect resources"
+                ))
+            else:
+                self.findings.append(self.create_finding(
+                    status="ERROR",
+                    region=region,
+                    resource_id=None,
+                    actual_value=protections["Error"].get("Message", "Unknown error"),
+                    remediation="Check IAM permissions for Shield API access"
+                ))
+        elif protections.get("Protections"):
+            # Filter for resources that support WAF (CloudFront and ALB)
+            waf_eligible_protections = [
+                p for p in protections["Protections"]
+                if ("cloudfront" in p.get("ResourceArn", "").lower() or
+                    "elasticloadbalancing" in p.get("ResourceArn", "").lower())
+            ]
+
+            if not waf_eligible_protections:
+                self.findings.append(self.create_finding(
+                    status="PASS",
+                    region=region,
+                    resource_id="shield:waf-associations",
+                    actual_value="No WAF-eligible protected resources found",
+                    remediation=""
+                ))
+                return self.findings
+
+            # Check each eligible resource for WAF association
+            for protection in waf_eligible_protections:
+                resource_arn = protection.get("ResourceArn", "")
+                protection_name = protection.get("Name", "Unknown")
+
+                # Determine the correct region for the WAF check
+                check_region = region
+                if "elasticloadbalancing" in resource_arn.lower():
+                    # Extract region from ALB ARN: arn:aws:elasticloadbalancing:region:...
+                    arn_parts = resource_arn.split(":")
+                    if len(arn_parts) >= 4:
+                        check_region = arn_parts[3]
+
+                web_acl = self.get_web_acl_for_resource(check_region, resource_arn)
+
+                if "Error" in web_acl:
+                    error_code = web_acl["Error"].get("Code", "")
+                    if error_code == "WAFNonexistentItemException":
+                        self.findings.append(self.create_finding(
+                            status="FAIL",
+                            region=check_region,
+                            resource_id=resource_arn,
+                            actual_value="No WAF web ACL associated",
+                            remediation="Associate a WAF web ACL with this resource for enhanced application layer protection"
+                        ))
+                    else:
+                        self.findings.append(self.create_finding(
+                            status="ERROR",
+                            region=check_region,
+                            resource_id=resource_arn,
+                            actual_value=web_acl["Error"].get("Message", "Unknown error"),
+                            remediation="Check IAM permissions for WAF API access"
+                        ))
+                elif web_acl.get("WebACL"):
+                    web_acl_name = web_acl["WebACL"].get("Name", "Unknown")
+                    web_acl_id = web_acl["WebACL"].get("Id", "")
+                    self.findings.append(self.create_finding(
+                        status="PASS",
+                        region=check_region,
+                        resource_id=resource_arn,
+                        actual_value=f"WAF web ACL associated: {web_acl_name} ({web_acl_id})",
+                        remediation=""
+                    ))
+                else:
+                    self.findings.append(self.create_finding(
+                        status="FAIL",
+                        region=check_region,
+                        resource_id=resource_arn,
+                        actual_value="No WAF web ACL associated",
+                        remediation="Associate a WAF web ACL with this resource for enhanced application layer protection"
+                    ))
+        else:
+            self.findings.append(self.create_finding(
+                status="FAIL",
+                region=region,
+                resource_id=None,
+                actual_value="No Shield Advanced protections found",
+                remediation="Enable Shield Advanced protection for resources and associate WAF web ACLs"
+            ))
+
+        return self.findings